In this paper, we aim to study the security vulnerability and robustness of concept-based models to carefully crafted malicious attacks, where an adversary with a malevolent intent aims to introduce perturbations to clean sample image and modify it in an adversarial manner to manipulate the concepts predicted by the model. Specifically, we first demonstrate how concepts learned by a concept-based model can be manipulated by introducing adversarially generated perturbations in input samples. The goal of attacker is to effectively manipulate concepts without changing the final model predictions. We will study different concept attacks - concept erasure, concept introduction and concept confounding - all of which disrupt the concept set predicted by a well trained concept-based model. Note that proposed attacks can be generalized for any concept-based model. We utilize Concept Bottleneck Models [1]} in this paper as an example to demonstrate the efficacy of our attacks on one of the most popular concept-based modelling paradigm. To improve trust and reliability of concept-based models, it is important that both concepts and predictions are robust to malicious attacks. Instilling trust in predictions are a well researched problem in adversarial literature. However, the robustness of concepts is an open question. In our paper, we focus on analyzing robustness of concepts without changing model predictions. This critical difference creates important distinction between our proposed attacks and standard adversarial attacks where goal of attacker is to change the prediction label.
